A Self-supervised Approach for Adversarial Robustness

Abstract

Adversarial examples can cause catastrophic mistakes in Deep Neural Network (DNNs) based vision systems e.g., for classification, segmentation and object detection. The vulnerability of DNNs against such attacks can prove a major roadblock towards their real-world deployment. Transferability of adversarial examples demand generalizable defenses that can provide cross-task protection. Adversarial training that enhances robustness by modifying target model's parameters lacks such generalizability. On the other hand, different input processing based defenses fall short in the face of continuously evolving attacks. In this paper, we take the first step to combine the benefits of both approaches and propose a self-supervised adversarial training mechanism in the input space. By design, our defense is a generalizable approach and provides significant robustness against the \textbf{unseen} adversarial attacks (\eg by reducing the success rate of translation-invariant \textbf{ensemble} attack from 82.6\% to 31.9\% in comparison to previous state-of-the-art). It can be deployed as a plug-and-play solution to protect a variety of vision systems, as we demonstrate for the case of classification, segmentation and detection. Code is available at: {\small\url{https://github.com/Muzammal-Naseer/NRP}}.

arXiv commentCVPR-2020 (Oral). Code this http https://github.com/Muzammal-Naseer/NRP}

References in corpus (17)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Deep Residual Learning for Image Recognition
• Ensemble Adversarial Training: Attacks and Defenses
• Empirical Evaluation of Rectified Activations in Convolutional Network
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• The Unreasonable Effectiveness of Deep Features as a Perceptual Metric
• Synthesizing Robust Adversarial Examples
• The relativistic discriminator: a key element missing from standard GAN
• Adversarial Examples Are Not Bugs, They Are Features
• Mitigating Adversarial Effects Through Randomization
• Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Training
• Fast Feature Fool: A data independent approach to universal adversarial perturbations
• APE-GAN: Adversarial Perturbation Elimination with GAN
• Boosting Adversarial Attacks with Momentum
• Defense against Adversarial Attacks Using High-Level Representation Guided Denoiser